Nancy

At a glance

• Editor score
  5.3 / 10
• Pricing
  Free plan
• Best for
  Go teams needing simple dependency audits
• Free plan
  Yes
• Paid from
  Free
• Facts checked
  19 Sep 2026

• Where it wins

  • Scans go.mod dependencies for known vulnerabilities through Sonatype Guide
  • Supports text, JSON, JSON-pretty, and CSV output
  • Offers CVE or Sonatype ID exclusions and local response caching

• Where it doesn't

  • Limited to Go module projects using go.mod
  • Does not provide reachability analysis
  • Does not generate verified SBOMs

Our verdict on Nancy

Nancy is an open-source command-line tool for detecting known vulnerabilities in dependencies of Go projects that use go.mod. It is aimed at teams that want a focused dependency audit they can run locally or incorporate into CI, rather than a broad software composition analysis platform spanning multiple ecosystems. The Open source plan is Apache-2.0 licensed and free. Nancy runs on Linux, Windows, and macOS, and can be installed from source or release binaries, through Homebrew on macOS, or in a container.

The workflow centers on checking dependencies through Sonatype Guide, with the option to submit scans to Sonatype Lifecycle. Output can be text, JSON, JSON-pretty, or CSV, which gives teams choices for readable reports and downstream processing. Vulnerabilities can be excluded by CVE or Sonatype ID, and local response caching is available. These controls make Nancy a practical fit for teams that want to tailor scan output or avoid repeatedly fetching responses. Its Sonatype connections are relevant if those services already form part of a team's dependency review process; otherwise, its core value remains a local Go-focused scan.

The trade-off is scope: Nancy scans Go modules only, has no reachability analysis, and does not generate verified SBOMs. Teams that need broader language coverage, reachability context, or verified inventory generation should consider a different tool. The repository identifies Nancy as part of Sonatype Nexus Community and says it is not officially supported by Sonatype, so organizations needing vendor-backed support should weigh that carefully. For Go teams seeking a free, narrow audit utility with multiple output formats, Nancy is a straightforward option; it is not a substitute for a wider SCA program.

Your product? Our editors can test Nancy in depth and publish a review, labelled as paid · from $149/mo →

Nancy pricing

All 1 Nancy plans and prices →

Nancy fact sheet

Nancy integrations

Nancy lists 3 integrations on its own site.

• Sonatype Guide
• Sonatype Lifecycle
• Homebrew

Alternatives to Nancy

• Snyk Open SourceBroad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.9.4
• FOSSAA mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.9.3
• Safeguard SCAA budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.9.1

See all Nancy alternatives →

Featured on iTechGuides

Nancy is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/nancy/"><img src="https://www.itechguides.com/best/badge/nancy.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update